Pin third-party actions by SHA and harden the npm release workflow

.github/workflows/ci.yml

@@ -31,13 +31,15 @@ jobs:
 
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6.1.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       - name: Use Node.js
         uses: actions/setup-node@v7
         with:
           node-version: 24
           cache: pnpm
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad # v3.0.4
         id: changes
         with:
           filters: |
@@ -83,7 +85,7 @@ jobs:
         if: |
           steps.changes.outputs.src == 'true' &&
           runner.os != 'Windows'
-        uses: coverallsapp/github-action@master
+        uses: coverallsapp/github-action@09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d # master
         with:
           github-token: ${{ secrets.github_token }}
           path-to-lcov: './coverage/chrome/lcov.info'
@@ -93,7 +95,7 @@ jobs:
         if: |
           steps.changes.outputs.src == 'true' &&
           runner.os != 'Windows'
-        uses: coverallsapp/github-action@master
+        uses: coverallsapp/github-action@09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d # master
         with:
           github-token: ${{ secrets.github_token }}
           path-to-lcov: './coverage/firefox/lcov.info'
@@ -108,7 +110,7 @@ jobs:
     steps:
       - name: Coveralls Finished
         if: needs.build.outputs.coveralls == 'true'
-        uses: coverallsapp/github-action@master
+        uses: coverallsapp/github-action@09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d # master
         with:
           github-token: ${{ secrets.github_token }}
           parallel-finished: true

.github/workflows/compressed-size.yml

@@ -17,9 +17,11 @@ jobs:
 
     steps:
     - uses: actions/checkout@v7
-    - uses: pnpm/action-setup@v6.1.0
+      with:
+        persist-credentials: false
+    - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
     - run: pnpm install
-    - uses: preactjs/compressed-size-action@v3
+    - uses: preactjs/compressed-size-action@261e5e2bb5332e35c78914ce69b4edcdf30da2ed # v3
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
         build-script: "pnpm run build"

.github/workflows/deploy-docs.yml

@@ -24,7 +24,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6.1.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       - name: Use Node.js
         uses: actions/setup-node@v7
         with:

.github/workflows/release-drafter.yml

@@ -26,6 +26,6 @@ jobs:
     needs: correct_repository
     runs-on: ubuntu-latest
     steps:
-      - uses: release-drafter/release-drafter@v6
+      - uses: release-drafter/release-drafter@6a93d829887aa2e0748befe2e808c66c0ec6e4c7 # v6.4.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -22,17 +22,18 @@ jobs:
 
   release:
     permissions:
-      contents: write  # for actions/upload-release-asset to upload release asset
+      contents: write  # for softprops/action-gh-release to upload release asset
     needs: setup
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6.1.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       - uses: actions/setup-node@v7
         with:
           registry-url: https://registry.npmjs.org/
           node-version: 24
-          cache: pnpm
       - name: Setup and build
         run: |
           pnpm install
@@ -57,27 +58,23 @@ jobs:
           VERSION: ${{ needs.setup.outputs.version }}
       - name: Upload NPM package file
         id: upload-npm-package-file
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VERSION: ${{ needs.setup.outputs.version }}
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
-          upload_url: ${{ github.event.release.upload_url }}
-          asset_path: ${{ format('chart.js-{0}.tgz', needs.setup.outputs.version) }}
-          asset_name: ${{ format('chart.js-{0}.tgz', needs.setup.outputs.version) }}
-          asset_content_type: application/gzip
+          files: ${{ format('chart.js-{0}.tgz', needs.setup.outputs.version) }}
+          fail_on_unmatched_files: true
   release-tag:
     needs: [setup, release]
     runs-on: ubuntu-latest
     if: "!github.event.release.prerelease"
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6.1.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       - uses: actions/setup-node@v7
         with:
           registry-url: https://registry.npmjs.org/
           node-version: 24
-          cache: pnpm
       - name: Setup and build
         run: |
           pnpm install